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[57] 



ABSTRACT 



An improved method and apparatus for administrative moni- 
toring nfa pflljinp; rarr] fraiiH prevention system is disclosed. 
An administrative monitor continuously oversees the func- 
tions performed by components of the fraud prevention 
system and thereby detects abnormalities in system perfor- 
mance. The administrative monitor regularly compiles status 
information from system components and applies a set of 
predefined thresholds in order to determine whether abnor- 
malities are present. Upon detection of an abnormaUty, the 
administrative monitor generates a health warning, which is 
displayed on workstation monitors to provide notice of the 
problem. 

14 Claims, 5 Drawing Sheets 
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ADMINISTRATIVE MONITORING SYSTEM for instance, take the form of a 1-800 (or 1-888) phone 

FOR CALLING CARD FRAUD PREVENTION number. When the user dials a 1-800 number, LEG equip- 
ment first determines which interexchange carrier is desig- 

RELATED APPLICATIONS nated to handle calls placed to that 1-800 number. This 

This is a continuation of prior application Ser. No. 08/884, ' determination is typicaUy made by passing a data message 
834, filed Jun. 30, 1997. now abandoned ^ local signal transfer point (STP) ^ the LEC, which naay 

query a database to find an associated IXC. In turn, after 

BACKGROUND OF THE INVENTION identifying the IXC, local equipment queries the long dis- 
tance carrier to determine whether the carrier and its equip- 

1. Field of the Invention iq ment is properly available to handle the call and whether the 
The present invention relates generally to telecommuni- carrier agrees to handle the call. This query passes between 

cations systems and more particularly to an improved sys- signal transfer points in the form of a data message identi- 

tem for detecting, analyzing and preventing fraudulent use fying information about the call such as the originating 

of telephone calling card numbers. The invention provides number, the target number, and the caller's billing number or 

enhanced intelligence and eflGciency in detecting fraudulent is calling card number. 

use of calling card numbers and may therefore assist a jxc equipment examines this information to determine 

telephone company in better identifying and responding to whether the call should be placed and, if so, which equip- 

calling card fraud. ment or logic should handle the call. Upon receiving con- 

2. Description of the Prior Art firmation that the proper lines and switches are available 
Telephone fraud is a major area of abuse in the United aloQg the call path from the originating phone through the 

States and throughout the world. Such fraud frequently target phone, the switches along the call path then complete 

involves the unauthorized or bogus use of telephone billing the call. 

numbers, which have been assigned to customers and are In advanced telecommunications systems, interexchange 
associated with customer billing accounts. These numbers carriers have seen a need to provide specialized services to 
are typically imprinted or encoded on wallet sized cards, meet diverse customer needs. In order to provide call 
which are provided to customers to enable the customers to handling services to meet these diverse needs, an interex- 
easily charge calls to their respective billing accounts. change carrier may include in each of its switches multiple 
Consequently, these numbers are commonly referred to as "originatingpartitions"or"o-parts," which identify logic for 
telephone calling card numbers. As those of ordinary skill in handling calls or bill numbers of particular types. 0-parts 
the art will appreciate, however, the terms "calling card "'^ have typically been used to provide "virtual private net- 
number," "billing number" and "bill number" are not works" (VPNs), which define the IXC caUing network 
restricted to card-based numbers but may refer more gen- available for specified bill types. 

erally to any number used to bill or track telecommunica- as an example, an IXC may provide multiple calling 

tions services. cards to a corporate customer for use by the corporation's 

The present invention may be used in the context of employees. Calls made with these cards bear a bill type 

telecommunications networks generally, including, for representing the corporate customer. Therefore, all of these 

example, the telephone network depicted and described in calling cards may be associated with a specific o-part in the 

U.S. Pat. No. 5,602,906, issued on Feb. 11, 1997 in the name IXC's switches, and the o-parl may identify logic such as a 

of Phelps, for a toll fraud detection system ("the Phelps VPN in the IXC's switches for processing calls made with 

patent.") The Phelps patent, which is assigned to the the' cards. In this scenario, customers using these cards may 

assignee of the present invention, is expressly incorporated or may not be aware that their caUs are being handled in a 

herein by reference. special way by a virtual private network, depending on the 

Atypical telecommunications network includes telephone design of the network. ^ 
units interconnected to each other via central ofiSces owned 45 As a nnthcf ^^ ^ppi^^ ir^^^^^^^i^^p ^^ ^ carrjprR may sell lon g 

by local exchange carriers (LECs). 'Iliese central offices are Hictj^p^^^ ci^r^if^f^ ^r. j pral PYph?i n£n ri^m'"f" "r "lh"r compa- 

in turn interconnected to each other via network equipment nies throughout the country that act as apparent "long 

owned by long distance service providers, or interexchange distance service providers" to callers. Ay TP.C ^ fnr jp stance^ 

carriers (IXCs). The LEC provides local switches for receiv- giay estahj js^ ite "nw"" Inng; dintan rn service Ip ^^cus- 

ing and forwarding calls placed to and from the interoon- 5Q t omers bv arranpin^ for a n interexchange carrier to supply 

nected telephone units as well as a tandem switch for passing thf> c/^rviV^ anH prnvjHmo' j^c i-nctnmprg with caHingcards. 

calls between the local switches and the IXC. The IXC in By arrangement with the IXC, tTiSB^rilinl^cards may be 

turn commonly includes tandem switches designed to associated with an o-part in the IXC*s switches that defines"" 

receive and forward calls to and from the LECs and from custom logic for processing calls made with the cards, 
point to point throughout the IXC's long distance network. 55 Fraudulent use of caUing card numbers has evolved over 

In the United States, when a call is placed firom a the years and has unfortunately responded to telephone 

telephone unit, equipment in the LEC central oflSce exam- company detection efforts. More particularly, as interex- 

ines the originating and target phone numbers in order to change carriers have developed new systems to detect and 

determine the availability of the target phone and in order to prevent fraud, criminals have developed new tactics for 

properly handle and bill the call. For local calls, one or more go defeating those very detection schemes. In an early form, for 

switches in the central office routes the call from the instance, calling card fraud was detected by customers or 

originating phone to the target phone if the target phone is long distance service providers who recognized the exist- 

available. ence of unauthorized charges on customer billing state- 

For long distance calls made with a calling card, a user ments. In response, interexchange carriers developed sys- 

typically places an initial call to a calling card platform in 65 terns for monitoring records of completed calls, in search of 

order to input the user's card number and destination phone aberrations or telltale signs of fraud. In turn, however, 

number. In many cases, this initial call is toll-free and may, criminals developed methodsof maximizing their fraudulent 
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use of card numbers before the calls are completed. For IXC generates a validation log message (VLM) that contains 

example, organized groups of criminals have arranged to information about the call attempt and that beneficially 

simultaneously or serially make multiple calls from phones includes an identification of the originating partition han- 

across the country using a single stolen calling card number. dling the call. Depending on the identity of the originating 

As another example, criminals have used stolen card num- 5 partition as specified by the VLM, the VLM is then directed 

bers to make expensive overseas calls that last many hours to one of multiple fraud analysis platforms for processing. In 

at a time and that evade detection until completed. ^^y^ specific fraud analysis may be efficiently tailored 

Calling card fraud has subjected interexchange carriers j^ggj varying needs. 

and others to financial loss, in part because the charges for ^ .1. ttt • ^ *l j • * ^ r j 1 .r 

such calls are frequenlly uncoUeclible. 'ITiis is especiaUy the ,„ ^ .'T*' « designated fraud platform 

case when unauthorized use is made of calling card numbers " X^M is subjected to a first group of fraud rules designed 

for placing international calls, because the interexchange f determme whether the ca 1 attempt is hkely to mvolve 

carrier handling the caU may have to transfer payments to f^^dulent use of the biU number. For ths purpose pertinent 

the destination telephone company, even if the toll charge is Actors representing telltale signs of fraud are developed 

uncollectible ^ through actual expenence, and the rules are modified as 

, rri-'^ necessary to incorporate these factors. Based on an appli- 

n addition the existing methods and systems of fraud ^^.j^^ ^ ^ ^^^^^^ 

detection employed by interexchange earners have been fr^ud^i.^, ^ fraud alert indicating the 

only partially successful. This IS illustrated, tor example, by , •, vu j *u * .u m - c ^ i * j .u * 

- . / . . . 'i, . 1 ,1 likchhood that the call is fraudulent, and the system passes 

the fact that some interexchange carriers will not place calls . ^ ^^^^ „^„^„^^ A.,ti,», o„„i„/-o -ru 

. i_ . • . : • rm. • the alert to a case manager for further analysis. The alert 

using a biUing number to certain suspect countries. This on r ui ■ * ^ j . u j *u * * • • ^ 

i e /• 1 t • ' preferably consists of a database record that contains infor- 

scheme, of course, unfortunately prevents some legitimate ^ ^. / * n . ■ i j- i-i i i. j .1. . 

. ' - . .... mation about the call attempt, including the likelihood that 

billing number calls from going through to these countnes. ^, ^- , c Ji . r.i. 

, r t . . . the call attempt mvolves fraudulent use of the respective bill 

turlher, fraudulent use of calling card numbers issued by number 

local exchange carriers or other "service providers" may not . , r . . . . .. , 

only affect the interexchange carrier that actually provides 25 , \ preferred embodnnent, the c:^ manager builds 

the service, but may also affect customer perception of the ^="^5' "^^^^^ bill-number by bill-number bas^ in order to 

local company that issues the cards. In some circumstances, ^""'^^1^, °^ ""^^ occumng 

these companies may in turn suffer financial loss as a result ^l"' '° ^f^'V^ cases preferably 

of such caUing card fraud. take the form of database records or case records that are 

. wu f *. r re • 4 1 • . 11- . each individually associated With one bill number. Each case 

A need therefore exists for a more efncient and inlelheent 30 j • ■ * 1 * j * * 1 . u j .l * 

t,,. jrjj..- record is in turn related to at least one subcase record that 

system of calhng card fraud detection. , ^ r j 1 ■ r l h i_ «7i. 1 . 

^ ^ defines a fraud analysis of the bill number. When a new alert 

SUMMARY OF THE INVENTION is generated in relation to a bill number as to which an open 

In a principal aspect, the present invention comprises an ^^isls, the case manager appends the alert to the 

improved system for detecting calling card fraud in a 35 currently active subcase, for analysis together with the other 

telecommunications network. Through its combined ^^^^^ subcase. In the event a case exists for the bill 

features, the present invention enables more intelUgent and number but the case has already been resolved, the case 

efficient detection of fraud and thereby facilitates enhanced, manager establishes a new subcase related to the case and 

real-time fi-aud prevention and cost savings. appends the alert to the new subcase. Still alternatively, if a 

llie present invention provides enhanced intelligence and 40 ""^.^ ^""^ ^^'^ "^"^^^^ docs mi yet exist or is not 

efficiency through features that enable fraud analysis to be available, then the case manager establishes both a new case 

better customized and managed. Improved customization is ^"^ ^^e case manager appends the alert to the 

achieved in part by employing existing information in the ^^"^ subcase, 

telecommunications network that identifies the service pro- The present invention enables streamlined access to exist- 

vider or provider of the bill number at issue and in part by 45 ^g firaud cases by interconnecting both a memory and a 

providing a variable set of rules for responding to fraud database file to the case manager. The memory holds fraud 

determinations. Improved management of fraud analysis is cases that have been accumulated over a preceding time 

provided in part by maintaining a case-subcase arrangement period, say the past three hours. The database file, in 

of fraud analysis information, by providing streamlined contrast, preferably holds fraud cases that have been accu- 

access to information in relevant cases, and by monitoring 50 mutated over a longer period of time, say the past three 

the ongoing fraud analysis process. Further, the invention months. This configuration beneficially enables quick access 

beneficially provides for substantially real time analysis of relatively recent information in the memory while still 

not only completed calls but also call attempts, thus enabling maintaining access to older information as well in the 

interexchange carriers to minimize the presence and efl'ect of database file. 

calling card fraud. 55 Once the case manager establishes or modifies a case for 

The invention applies a set of fraud analysis routines to a an existing alert, the invention beneficially applies an addi- 

call attempt in an effort to determine whether the call attempt tional set of rules to the case. Among these second level 

involves fraudulent use of a bill number. In a preferred rules, the present invention automatically blocks subsequent 

embodiment, the set of fraud analysis routines is selected use of the bill number if any alert associated with the 

based upon the identity of the bill type or service provider 60 pending case represents a likelihood of fraud greater than a 

for the given bill number and may therefore be customized specified level. In this regard, however, the invention advan- 

to suit the needs of the service provider. For this purpose, the tageously provides exceptions to automatic blocking. The 

invention conveniently obtains the identification of the bill invention may, for instance, include a file of bill numbers 

type or service provider from the originating partitions designated to not be automatically blocked, notwithstanding 

contained in network switches. es ^he presence of the specified minimum likelihood of fraud 

When a user attempts to make a call using a bill number, After these additional rules have been applied to the 

regardlessof whether the user's bill number is approved, the pending case, case records are then passed to a queue for 
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manual analysis by fraud researchers. Each fraud researcher 
is positioned at a fraud workstation, which conveniently 
provides the researcher with access to case and subcase 
information, customer information and assorted tools con- 
figured to facilitate an educated review of the case at issue. 
For instance, by selecting various menu items or icons on a 
workstation display, the researcher may filter incoming 
cases, view or retrieve desired cases, and view customer 
account information. 

The researcher in turn conducts an analysis of the case and 
may easily refer to the subcases within the case. Upon 
resolution of the case, the fraud researcher may elect to 
block the bill number from subsequent use or may choose to 
close the case and leave the bill number active. 

As call attempts and completed calls are analyzed by the 
fraud system of the present invention, an administrative 
process is employed to monitor the status of ongoing analy- 
sis and to check for malfunctions in the system. The admin- 
istrative process obtains status information from compo- 
nents of the system and may, for instance, generate system- 
wide warnings when malfunctions are detected. In this way, 
the present invention achieves still greater precision and 
efficiency in detecting and preventing calling card fraud. 

These as well as other advantages of the present invention 
will become apparent to those of ordinary skill in the art by 
reading the following detailed description, with appropriate 
reference to the accompanying drawings. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Preferred embodiments of the present invention are 
described herein with reference to the drawings, in which: 

FIG. 1 is a block diagram of a telecommunications 
network that may include the improved method and appa- 
ratus of the present invention; 

FIG. 2 is a block diagram illustrating the flow of infor- 
mation in a preferred embodiment of the present invention; 

FIG. 3 is a flow chart illustrating the fraud detection and 
prevention process in a preferred embodiment of the present 
invention; 

FIG. 4 is an illustration of a fraud workstation employed 
in a preferred embodiment of the present invention; and 

FIG. 5 is a block diagram of the administrative monitoring 
system shown in FIG. 2, 

DETAILED DESCRIPTION OF THE 
PREFERRED EMBODIMENTS 

Referring to the drawings, FIG. 1 illustrates the arrange- 
ment of a telecommunications network 10 that may employ 
the fraud detection and prevention system of the present 
invention. The arrangement shown is presented for purposes 
of illustration only and is not intended to limit the context of 
the present invention. 

Telecommunications network 10 generally includes origi- 
nating telephone units 12, 14, an originating local exchange 
carrier (LEC) 16, a long distance carrier or interexchange 
carrier (IXC) 18, a terminating local exchange carrier (LEC) 
20, and terminating telephone units 22,24. LEC 16 is respon- 
sible for routing local calls between telephone units 12 and 
14. Additionally, LEC includes local switches 26, 28, tan- 
dem switch 30, signal transfer point (STP) 32 and database 
34. IXC 18 includes remotely positioned tandem switches 
36, 38 that are respectively interconnected to signal transfer 
points 40, 42. Additionally, STPs 40, 42 are both intercon- 
nected to a signal control point (SCP) 44, although those 
skilled in the art will recognize that multiple redundant SCPs 
may be provided throughout IXC 18. 
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When a user places a calling card call from telephone unit 
12, for instance, the user may dial a toll-free phone number 
(such as a 1-800 or 1-888 number) that is associated with a 
calling card platform in the telecommunications network. In 

5 turn, local switch 26 launches a query to STP 32, which 
determines by reference to database 34 the identity of the 
long distance carrier designated to handle the toll-free phone 
number. The information contained in database 34 is typi- 
cally compiled in advance by arrangement between the LEC 

10 and various IXCs. 

Once the designated IXC is identified, LEC equipment 
routes the call to the IXC switch 36 for processing by an 
associated calling card platform. For this purpose, switch 36 
contains or constitutes the calling card platform. However, 

15 those of ordinary skill in the art will appreciate that the 
platform may alternatively be external to the switch, in 
which case switch 36 would route the cafl to the external 
platform for processing. 

The calling card platform may collect a variety of infor- 
mation about the attempted call, including the originating 
phone number (ANI), the destination number, the bill 
number, and the bill type (such as an identification of the 
service provider or the entity that issued the billing number). 
Typically, the platform identifies an originating partition 
(o-part) associated with the incoming calling card call and 
accordingly determines the associated bill type. In many 
cases, this o-part will in turn identify the logic used to 
process the call. The platform then plays a message prompt- 
ing the caller to dial or otherwise input the caUer's card 

■'^ number and desired destination phone number AdditionaUy, 
the platform obtains other information, such as the originat- 
ing ANI and originating phone type, through one or more 
data messages passed from local STP 32 to network STP 40. 
These data messages are typicaUy transmitted as out-of-band 
signals in relation to voice-band communications signals 
and may be carried by a separate line or in a separate data 
channel. 

Upon receiving the necessary information, switch 36 
queries SCP 44 in order to determine whether the caller's 
bill number is valid. SCP 44, in response, returns a valida- 
tion message to switch 36 indicating either that the bill 
number is approved or that the bill number is not approved. 
In addition, through a series of data messages, switch 36 
communicates with remote switch 38 and LEC 20 to ensure 
the availability of connections for handling the call. In the 
event the bill number is approved and the lines are available 
to the terminating phone, a series of data messages pass 
through the signal transfer points along the entire call path 
notifying the switches to open the connection between the 
originating and terminating phones. 

Referring now to FIG. 2, the present invention is shown 
as a fraud system 50, which is interconnected to a service 
control point management system (SCPMS) 52 and billing 

55 server 54. SCPMS 52 is in turn interconnected to SCP 44 
and is employed when switch 36 (via STP 40) seeks vali- 
dation of a caUcr's billing number as discussed above. 
BilHng server 54 is further interconnected to switch 36 and 
receives information such as the time, duration and cost of 

50 the call at issue for use in billing the call. 

Fraud system 50 preferably includes one or more software 
routines or processes executed by one or more processors. In 
this regard, the present invention is not limited to a structure 
consisting multiple discrete computers performing separate 

65 software routines. Rather, as those of ordinary skill in the art 
wfll appreciate, much of fraud system 50 may be embodied 
in a single set of routines or threads executed by a single 
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processor or in various combinations of processors and 
software instructions. Therefore, where reference is made to 
one processor or one routine, the present invention may 
alternatively employ multiple processors or multiple rou- 
tines. Similarly, where reference is made to multiple pro- 
cessors or multiple routines, the present invention may 
alternatively employ to a single processor or a single routine. 

In the preferred embodiment, fraud system 50 includes a 
case manager processor operating a case manager process 
56. The case manager processor is in turn interconnected to 
one or more servers 58, 60, a memory 62, a database server 
operating a case record database 64, and fraud analysis 
workstations 66. Additionally, the case manager processor is 
interconnected to a customer service information (CIS) 
system 68, which is typically located outside the fraud 
system 50. Fraud system 50 also preferably includes an 
archive 70 in the form of optical disks for storing historical 
fraud analysis records. Still further, fraud system 50 is 
associated with an administrative monitor 76, which pref- 
erably monitors all processes running in the system and may 
be either internal or external to fraud system 50. 

In one embodiment, for instance, the case manager 
processor, the database processor and servers 58, 60 each 
take the form of Sun 1(XX)E servers. Additionally, fraud 
analysis workstations 66 may take the form of Sun Spark 5.4 
computers, and CIS 68 may take the form of a Sun Spark 20 
server. 

The fraud system of the present invention interfaces with 
switch call information and with customer information in 
order to build and analyze fraud cases. Switch call infor- 
mation concerns attempted and completed calls and takes 
the form of call related messages such as validation log 
messages (VLMs) and call data records (CDRs). Customer 
information, which is maintained by CIS 68, concerns 
customer accounts and may include, for instance, invoices, 
payment history and notes regarding customer disputes. 

FIG. 3 illustrates the process flow in a preferred embodi- 
ment of the present invention. Referring to FIG. 3, at step 
100, VLMs and CDRs are independently provided to fraud 
system 50. VLMs are generated by the IXC for purposes of 
fraud analysis at the time a user attempts to place a calling 
card call, regardless of whether the user's bill number is 
approved. More particularly, as discussed above, SCP 44 
provides a card validation to switch 36 (via STP 40). At the 
same time, SCP 44 provides a record of the call attempt to 
SCPMS 52. SCPMS 52 in turn generates a VLM and passes 
the VLM to fraud system 50. Call data records (CDRs), on 
the other hand, are normally generated at the conclusion of 
a successfully placed call and are typically used by the IXC 
to compile billing and other customer records. 

In the preferred embodiment, the VLM may take any of 
a variety of forms but should include certain minimum 
information about the attempted call, such as the originating 
number, terminating number, calling card munber, and origi- 
nating partition associated with the call. The VLM may be 
formatted as a database record, for instance, that includes the 
following fields defining the call attempt: 



Field Length Type 



Card Type 1 ASCII 

Calling Qird Number 12 BCD 

Ortg. Point Code 3 Binary 

Card Status (for call) 1 BCD 

Called Number 8 BCD 
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-continued 



Field 


Ijcngth 


lype 


Nature of Number 


1 


BCD 


Calling Number 


8 


BCD 


Nature of Number 


1 


BCD 


Info Digits 


1 


BCD 


Service Class 


1 


BCD 


Originating Partition 


2 


BCD 


Class of Service 


2 


Binary 


Filler 


9 


Binary 



To a limited extent, a CDR will contain the same infor- 
mation as the VLM for a given call. This information may 
include, for instance, the originating and terminating num- 

35 bers and the calling card or account number being used. In 
addition, a COR typically includes billing information such 
as the start and stop times of the call and the call duration. 
Like the VLM, the CDR may be formatted as a database 
record but includes fields defining the completed call. Upon 

20 arrival at the fraud system 50, CDRs may be filtered in order 
to eliminate CDRs associated with calls made without 
calling cards, such as 1-plus calls. 

By providing a VLM to fraud system 50 when a calling 
card call is attempted, the fraud system is able to quickly 

25 respond to fraudulent calls before the calls are completed 
and, in many cases, while the resulting call is in progress. 
Moreover, the present invention beneficially incorporates in 
the VLM an identification of the originating partition or 
o-part associated with the given call. As discussed above, the 

30 o-part identifies logic in the IXC switch 36 that processes 
calls of specified bill types and may serve, for example, to 
identify the calling card service provider, or customer, for 
whom the IXC supplies long distance communications ser- 
vice billed to the card number at issue. By incorporating an 

35 identification of the o-part in each VLM, the present inven- 
tion is thus able to readily tailor fraud analysis to the needs 
of various service providers. 

More particularly, fraud system 50 may be configured as 
multiple fraud platforms for conducting specialized fraud 

40 processing, in order to serve varying needs. Independent 
platforms may, for instance, provide different levels of fraud 
detection. One platform may provide the most complete 
available fraud analysis on call attempts and completed 
calls, while another platform may provide less stringent 

45 firaud analysis. In this way, an IXC may, for instance, 
simultaneously supply different fraud analysis services, or 
routines, for different bill numbers or for different bill types. 
In the preferred embodiment, the present invention accom- 
plishes this by conveniently referring to the o-parts identi- 

50 fied in incoming VLMs and directing the VLMs to the fraud 
platform that is associated with the respective o-part. In this 
regard, while FIG. 2 illustrates a single set of components 
designated as fraud system 50, the arrangement of fraud 
platforms according to the present invention may vary. Each 

55 platform, for example, may separately include its own case 
manager, memory, case record database, archive and fraud 
workstations. Alternatively, multiple fraud platforms may 
exist in the form of separate software routines or processes 
mn on a single set of components as depicted in FIG. 2. 

60 Upon arrival at the fraud system 50, a VLM is preferably 
received by a computer system such as server 58, which 
examines the o-part information included in the VLM and 
sends the VLM to the firaud platform associated with the 
given o-part, as indicated at step 101 in FIG. 3. For this 

65 purpose, a processor in server 58 may, for instance, refer to 
a table or other file that indicates which fraud platforms are 
associated with which o-parts. 
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As shown at step 102 in FIG. 3, once a VLM or CDR availability of double-red alerts for calls placed with the 

arrives at fraud system 50, the fraud system runs a set of first customer's card number. 

level rules on the VLM or CDR in order to determine Once an alert has been generated, the respective server 

whether the underlying call attempt or call is likely to forwards the alert record to case manager 56, as indicated at 
involve fraudulent use of a bill number. These rules or "fraud 5 step 106 in FIG. 3. In the preferred embodiment, case 

indicia" preferably take the form of tables or files of predi- manager 56 consists of a software process running on a 

cates that are loaded into a computer system such as server server, or processor. Case manager 56 is responsible for 

58 or server 60. By storing these rules in this form rather building and modifying cases based on alerts and for for- 

than encoding the predicates in software, the predicates may warding designated cases to a queue for manual fraud 
conveniently be configured or modified as new fraud see- lO analysis. 

narios arise and as empirical experience dictates. ^he present invention beneficiaUy organizes fraud analy- 

The first level rules may generally fall mto several sis of bill number use into a case-subcase configuration. In 

categories, including (i) those related to velocity or fre- this configuration, a case represents fraud analysis related to 

quency of call placement, (ii) those related to suspect g given bill number, and each case "contains" one or more 
originating or terminating locations or ANIs, (iii) those 15 subcases defining instances of fraud analysis and including, 

related to the time duration of calls, (iv) those related to for instance, any pertinent notes regarding fraud analysis of 

multiple simultaneous use of a bill number, and (v) those the case. Cases and subcases preferably take the form of 

related to repeated abuse for a given originating and termi- database records bearing a one-to-many database relation- 

nating number. However, those skilled in the art wiU appre- ship with each other. Subcases, in turn, bear a one-to-many 
ciate that numerous other fraud indicia may be known or 20 database relationship with alerts involving use of the given 

may be developed in the fiiture and employed within the bill number. Additionally, cases are either in an open state or 

scope of the present invention. In addition, it should be a closed state, which may be indicated for instance by a flag 

appreciated that different sets of indicia may beneficially be or field in the case record. A case is open when fraud analysis 

applied to VLMs and CDRs in view of the different timing pending and not yet resolved in a related subcase. On the 
and information associated with these input records. 25 ^^^^j. handy a case is closed once analysis in the related 

In the event the VLM or CDR at issue satisfies predeter- subcase has been resolved, 

mined fraud indicia, the respective server (58 or 60, for In the preferred embodiment, case manager 56 sets a fraud 

instance) generates an alert, as shown at step 104 in FIG. 3. condition of the case to the highest fraud condition of any 

In the preferred embodiment, this alert is generated by a alert related to that case, as shown at step 108 in FIG. 3. lliis 

software routine running on the server and takes the form of fraud condition may. Cor instance, be indicated by a field in 

a database record referred to as an alert record. The alert the case record. For instance, if a case record includes a 

record preferably contains fields of data including those subcase that involves (or is related to) both an orange alert 

carried by the VLM or CDR as well as an indication of the and a double-red alert, case manager 56 would preferably set 

level of likelihood that the underlying calling card use is the fraud condition of the case to double-red. 
fraudulent. This level of likehhood may be viewed as a fraud ^ ^he case-subcase configuration of the present invention 

condition of the alert. improves over existing systems that serially record bill 

In the preferred embodiment, the fraud condition of an number use or that generate and separately analyze alerts for 

alert is selected from a set of available fraud conditions that each instance of supposed bill number fraud. As those 

are contained in a table or file stored in a memory or other skilled in the art will appreciate, each new analysis of bill 

medium accessible by the server. Because the fraud condi- number use in existing fraud detection systems typically 

tions themselves are preferably not written into computer disregards prior fraud analysis of the bill number or requires 

code, the set of available conditions may be modified as an analyst to reconstruct a history of use from numerous 

necessary without the need to rewrite software. In the independent records or fields. The case-subcase arrangement 

preferred embodiment, the available fraud conditions and of the present invention, in contrast, provides flexibility and 

hence the available alerts may be designated by color codes quicker reference to related data and thereby facilitates more 

representing degrees of significance, such as yellow, orange, prompt and efficient fraud analysis, 

red and double-red. In this scheme, for instance, red reflects present invention ftirther provides streamUned access 

suspect use of a biU number, and double-red reflects highly to case records and their related subcases and alerts. To this 

suspect use of a bill number, epj^ the preferred embodiment, case records are stored in 

To enhance the utifity of fraud system 50, the set of memory 62 for a specified time period such as three hours 

available fraud conditions may be customized to suit varying and in case record database 64 for another time period such 

needs. To do so, the server receiving the VLM or CDR may as three months. It will be appreciated, of course, that these 

be set to filter the set of available conditions based on a time periods of storage in memory 62 and in case record 
number of factors. These factors, like the fraud conditions 55 database 64 may or may not coincide with each other and 

themselves, are preferably stored in an accessible table or may vary depending on hardware or other constraints, 

file for convenient reference and modification as necessary. Further, after a specified time period, case records may be 

As an example, the present invention may conveniently archived on optical disks 70 or another suitable storage 

provide time-based filters, which modify or restrict the set of medium. 

available alerts depending on the time of day, the day of the 60 As those of ordinary skill in the art will understand, 

week or the date. It is therefore possible, for instance, to information stored in memory is typically much more vola- 

allow special alerts on holidays or to preclude certain alerts tile and easily accessible than information stored in a 

at various times of day. As another example, the invention database file. Tlierefore, by storing more recent case records 

may filter the available alerts based on the identity of the in memory 62 and older case records in case record database 
calling card number or customer account at issue. In this 65 64, case manager 56 may more readily access case records 

way, for instance, a customer may arrange with the IXC to associated with recent fraud analyses but may still access 

impose less restrictive fraud analysis by eliminating the older case records as well. As a result, the present invention 
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enables an interexchange carrier to more efficiently handle automatically blocked, reduction of the fraud condition on 

frequent fraud scenarios involving the same bill number, sensitive cases, various account-level rules, and other fraud 

because recent cases related to the bill number will be more analysis rules now known or later developed, 

readily accessible. For instance, the present invention includes an advanced 
When case manager 56 receives a new alert, the case 5 system for responding to alerts higher than a predetermined 

manager applies a software routine to establish a case, which level. According to this system, when the fraud condition of 

may entail modifying an existing case or establishing a new a case is at least a predetermined level, case manager 56 will, 

case. To this end, the case manager first searches memory 62 in general, automatically block or "auto-stun" use of the 

and case record database 64 for an existing case record underlying bill number. In turn, case manager 56 notifies the 
related to the bill number at issue, as indicated at step 110 10 network SCPMS 52 that the card has been blocked and 

in FIG. 3. In particular, case manager 56 preferably first updates the status of the bill number in CIS 68 for subse- 

searches memory 62, and, if it does not find an existing case quent reference by customer service personnel. Additionally, 

record for the bill number in the memory, it launches a query case manager 56 preferably then places the case in a "call 

for an existing case record in case record database 64. back" queue for manual analysis by fraud researchers as will 
Alternatively, case manager 56 may simultaneously search 15 be described below. 

both memory 62 and case record database 64 for an existing in order to further facilitate enhanced customization, 

record. however, the present invention additionally employs a "no- 

In the event case manager 56 finds an existing case record autostun" file as well. The no-autostun file beneficially lists 
for the bill number at issue, the case manager checks bill numbers that should not be auto-stunned and therefore 
whether the case record is open or closed, as shown at step provides a useful exception to automatic blocking. Informa- 
112. If the case record is open, by definition, a related tion in the no-autostun file may be compiled, for instance, 
subcase is open as well for analysis of an existing alert upon customer request. Further, added security may be 
regarding use of the bill number. Therefore, at step 114, case provided by setting expiration dates for all data maintained 
manager 56 then appends the new alert record to the open in the no-autostun file and accordingly removing bill num- 
subcase record, preferably by establishing a database rela- bers from the file after specified periods of time. In the 
tionship between the two records. In this way, the existing preferred embodiment, if a bill number at issue is listed in 
open subcase will "contain" information about both the the no-autostun file, but the case would normally be auto- 
existing and new alerts and will thereby facilitate eflScient stunned, the case is passed directly to a researcher queue for 
and effective fraud analysis. analysis as described below. 

If, on the other hand, the existing case record is closed, by Case manager 56 may also apply one or more account- 
definition, fraud analysis in a related subcase has been level rules or bill-number based rules to the case at issue, 
concluded, or resolved. Therefore, at step 116, case manager Account-level rules are a set of rules applicable to a given 
56 then creates a new subcase record, relates the new customer account. For instance, when an IXC has issued a 
subcase record by a database relationship to the case record set of calling cards to a corporate client, the corporation may 
and appends the new alert to the new subcase as discussed wish to prevent those card numbers from being auto-stunned 
above. by the IXC's fraud prevention system. For this purpose, an 

In the event case manager 56 does not find an existing account level rule may be employed to provide exceptions to 

case record corresponding to the bill number, case manager automatic blocking provisions for all card numbers within 

56 creates a new case record for the bill number and a new the customer's account rather than on a bill-number by 

subcase record related to the case record. As shown at step bill-number basis as with the no-autostun file. 

118, case manager 56 then appends the new alert to the new Bill number rules, in contrast, are a set of rules keyed to 

subcase as discussed above. In addition, at step 120, case specific bill numbers. For instance, a customer may arrange 

manager 56 preferably obtains pertinent customer informa- with the IXC to always reduce the fraud condition of any 

tion from CIS 68 and includes, or appends, this information case associated with the customer's bill number to, say, 

in the case record to aid in subsequent fraud analysis of the yellow. Bill number rules such as this may be stored in 

customer's bill number. In the preferred embodiment, case attribute tables and may be conveniently modified as nec- 

manager 56 does not include customer notes from CIS 68 at essary or referenced and applied by the case manager, 

this time, as customer note information tends to be cumber- still further, case manager 56 may be set to automaticaUy 
some and typically unnecessary until a case record is passed jq reduce or "demote" the fraud condition of cases that are 

to a researcher for manual fraud analysis. considered to be sensitive. Sensitive cases may be identified 

Once case manager 56 has built a case corresponding to by associated bill numbers listed in a sensitive file. Rather 

the bill number at issue, the case manager may store the than proceeding with standard fraud analysis of sensitive 

current alert in an appropriate table in the case record cases, case manager 56 may reduce the fraud condition of 
database file. From there, the alert may subsequently be 55 those cases to a lowest possible level, such as white, and 

referenced for purposes of fraud analysis. close the cases. 

In the preferred embodiment of the present invention, case As those skilled in the art will appreciate, case manager 

manager 56 next applies a series of additional fraud analysis 56 may apply still other rules that do not fall into the above 

rules to the case, as shown at step 122. These "case based categories. For instance, if a user travels from home and uses 
rules" may result in positive or negative adjustments of the 60 a calling card to call a suspect city, fraud system 50 may 

case fraud condition or other adjustments to the case generate an alert. Case manager 56, however, may apply a 

depending on a variety of factors. Like the fraud indicia rule to the case that refers to the user's billing invoice as 

discussed above, these rules may beneficially be stored in maintained in the CIS records. If, for example, the user's 

attribute tables or other files for easy reference and modi- latest bill indicated that the user made and paid for five calls 
fication as deemed necessary, lliese additional rules may 65 to the same suspect city from the user's home, then case 

include, for instance, identification of cases to be automati- manager 56 may determine that the alert is erroneous, and 

cally blocked, identification of cases that should not be case manager 56 may close the case without further analysis. 
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Once case manager 56 completes its application of case- the case fraud condition and a description of the current 

based rules, at step 124, the case manager preferably places subcase (including, for instance, the time the underlying 

each case into one of several condition queues to be worked alert arose and the basis for the alert). A third section on the 

by skilled fraud researchers at workstations 66. To do so, the monitor may simultaneously display other pertinent 

case manager may conveniently pass to the queue a record 5 information, such as a chronology of previous subcases 

that defines basic customer information (such as the bill related to the case at issue, or additional, more detailed 

number and the associated case fraud condition) and that customer information. Still another section may simulta- 

defines the current subcase (such as the subcase fraud neously display a chronology of actions taken by the 

condition and a description of the alert that gave rise to the researcher, for instance, with respect to the case currently at 

subcase). As will be described below, the researcher may 10 issue. 

subsequently select and view other information related to the Workstation 66 displays a number of indicia that enable a 

case, such as previous subcases and other customer infor- researcher to view pertinent information and modify case 

mation. In an alternative embodiment, however, the inven- records as necessary. In the preferred embodiment, these 

tion may initially pass to the queue a record of the entire indicia individually take the form of a menu item or an icon, 

case, including all related subcases and pertinent customer 15 The researcher may select one or more of these indicia with 

information. a mouse or other pointing device in order to invoke one or 

The process of passing a record to a queue may include more desired tools. Of course, those of ordinary skill in the 

passing all or part of the actual record and/or passing a art will appreciate that numerous other mechanisms may 

pointer to the record. In the preferred embodiment, the case now exist or may later be developed to enable a fraud 

manager passes a complete case record to the queue by ^0 researcher to selectively view one or more sections of 

converting all of the pertinent information into a concat- pertinent information at workstation 66 within the scope of 

enated ASCII character string and transmitting the string via the present invention. 

a local area network to a workstation 66. Upon receipt, the As an example, workstation 66 may include a menu item 

workstation parses the character string into respective infor- or icon designated as a case filter or as filter indicia. When 

mation (such as discrete subcases and customer information) 25 researcher selects this item or icon, a window may open 

for manipulation and viewing by the researcher. on monitor 74 prompting the researcher to provide proper- 

In the preferred embodiment, only cases that bear at least ties defining the scope of cases for the researcher's queue, 

a specified minimum fraud condition, or analysis level, are Through this property window, the researcher may specify, 

passed on for manual analysis. For this purpose, as an for instance, that the researcher's workstation will receive 

example, separate condition queues may be provided for red only those cases that have certain fraud conditions or that are 

cases and double-red cases. Additionally, cases arc prefer- associated with calls having certain originating or tcrminat- 

ably provided to the researchers on a priority basis keyed to ing ANIs or calls that originated from certain types of 

fraud condition and chronology. phones. Additionally, or as part of this property window, 

Individual researchers may also be supplied with their workstation 66 may include a menu item or icon that, when 

own queues of assigned or selected cases for analysis. In this selected, will cause workstation 66 to launch a query with 

regard, in order foster expertise in particular areas and to casemanager56todetermineanddisplay a count of existing 

thereby further enhance the efficiency of fraud system 50, cases that satisfy the specified filter properties. In this way, 

researchers' queues may be filtered based on various factors, the researcher may conveniently determine whether the 

as will be described below. As an example, a researcher may specified filter properties are likely to produce a case load of 

be limited to analyzing cases regarding calls that originated reasonable scope. 

from pay phones or from phones in prisons. Alternatively, a As another example, workstation 66 may include previous 

researcher may be limited to receive only those cases that subcase indicia. When the researcher selects such indicia, 

relate to calls placed to designated suspect countries. workstation 66 displays in a section of monitor 74 informa- 

In the preferred embodiment, workstations 66 provide a 45 tio" that defines previous subcases related to the case at 

useful set of tools to enable researchers to effectively and issue. This information may appear, for instance, in the third 

efficiently conduct fraud analysis. As depicted in FIG. 4, section described above and may take the form of a descrip- 

each workstation preferably includes a computer 72 and a tive list of previous subcases. By enabling the researcher to 

monitor 74. Computer 72 is interconnected to the case view a streamlined chronology of the previous subcases 

manager 56 as well as to the customer information system or 50 related to the current case, the present invention additionally 

customer information database 68. Computer 72 may facilitates quick and efficient fraud analysis, 

thereby receive case related information (such as subcase As still another example, each workstation 66 enables a 

data and basic customer information) from the case manager researcher to view not only the basic c*ustomer information 

and customer related information (such as customer invoice that is included as part of the case at issue but also all 

or dispute information) from CIS 68. 55 customer information maintained in CIS 68. For this 

Aresearcher may selectively view on monitor 74 all of the purpose, in the preferred embodiment, a link to CIS 68 is 

information associated with the case at issue, including prior established by IBM 3270 emulation software interconnected 

subcases related to the current subcase, as well as alert to a Legacy customer database in CIS 68. 

information associated with the current subcase or related By selecting designated customer information indicia 

subcases. For this purpose, monitor 74 may conveniently 60 displayed on monitor 74, a researcher may cause worksta- 

display multiple windows (discrete display sections) of tion 66 display in one or more windows on monitor 74 

useful information simultaneously for quick reference by the specified customer information from CIS 68. One such 

researcher who is attempting to resolve the case. As an window may, for instance, provide basic customer informa- 

example, a first section on the monitor may display basic tion (such as the customer's bill number, name, address and 

customer information, such as the bill number and the 65 phone number), while other windows may provide customer 

customer name and address. A second section on the monitor invoice or payment information or notes regarding customer 

may simultaneously display basic case information, such as disputes. Some or all of this customer information may, for 
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instance, appear in a designated section on monitor 74, such 
as the third section discussed above. 

By thus integrating full access to customer information 
directly on the monitor 74 of fraud workstation 66, the 
present invention beneficially avoids the need to provide 5 
researchers with one monitor dedicated to fraud analysis and 
another monitor dedicated to CIS access. Instead, the 
researcher may conveniently view all necessary information 
on a single monitor. In this way, the present invention allows 
the researchers to more accurately and quickly complete 10 
their analyses. 

As a further convenience and aid to fraud analysis, when 
case manager 56 receives an alert and establishes a subcase 
that is associated with a case currently being analyzed at a 
workstation 66, case manager notifies the workstation of the 
new alert. In the preferred embodiment, case manager 56 
does so by transmitting to the workstation a message indi- 
cating the existence of the new alert. The message appears 
on the workstation monitor 74, for instance, in a status 
section at the base of the monitor. 

Workstation 66 in turn preferably includes refresh indicia 
displayed on monitor 74. When a researcher receives notice 
of a new alert related to the case currently at issue, the 
researcher may select the refresh indicia. In response, work- 
station 66 obtains from case manager 56 an updated case 
record or at least that portion of the case record defining the 
new, related subcase. 

In an alternative embodiment, it will be appreciated that 
a case record currently at issue at workstation 66 may be 
directly linked to the case record data stored in memory 62 
(or in case record database file 64). In this way, whenever 
case manager 56 revises the case record, the revisions will 
automatically appear at workstation 66 for consideration by 
the fraud researcher. In this alternative embodiment, the 
researcher may or may not be required to take any action in 
order to refresh the current case. 

Still further, workstation 66 provides a researcher with the 
abihty to selectively view another case or to switch to a new 
current case. For this purpose, each workstation 66 may 40 
provide case selection indicia on monitor 74. The case 
selection indicia may, for instance, take the form of a menu 
item providing the researcher with several options. As an 
example, the researcher may opt to retrieve a next case from 
the queue. In this instance, workstation 66 would preferably 45 
retrieve the next case that satisfies any filter properties 
previously established for the workstation or for the 
researcher. 

As another example, the researcher may opt to view in 
read-only form a case that is based on specified parameters. 50 
For this purpose, when the researcher selects the associated 
case-selection indicia on monitor 74, workstation 66 
prompts the researcher to identify a desired case, for 
instance, by bill number or other unique information. In 
response, workstation 66 queries case manager 56 for the 55 
requested case. If the requested case exists, case manager 56 
provides the case record to the requesting workstation in 
read-only form. In a related aspect of the present invention, 
a researcher or supervisor may selectively view in read-only 
form (in a discrete window on monitor 74, for instance) a 60 
fraud analysis session that is pending at another workstation. 
This feature may be useful for a number of purposes, 
including training researchers and compiling reports that 
may assist in the revision of rules applied by fraud system 
50. 65 

As still another example, the researcher may opt to 
retrieve a new current case based on specified parameters 



129 

16 

such as a bill number, a case ID or other information unique 
to a case record. In the preferred embodiment, when the 
researcher selects the associated case-selection indicia on 
monitor 74, workstation 66 prompts the researcher to enter 
one or more search parameters. Based on this parameter or 
parameters, workstation 66 queries case manager 56 for the 
requested case. 

Case manager 56 in turn searches memory 62 and/or 
database 64 as described above. If the case manager locates 
the requested case, the case manager passes the case to the 
requesting workstation. In this regard, if, the requested case 
is currently being analyzed at another workstation, the case 
manager may provide the case to the requesting workstation 
in read-only form as noted above. Further, if the researcher 
has specified a bill number and case manager 56 does not 
find a corresponding case, then case manager 56 preferably 
establishes a new case corresponding to the bill number, 
assigns a low fraud condition (such as yellow) to the case 
and passes the case to the requesting workstation. This 
feature beneficially enables a researcher to form a new case 
for analysis when necessary. 

As yet another example, the researcher may opt to retrieve 
a case that has been held in a "call back" queue. In the 
preferred embodiment, a call back queue serves to hold 
cases that require further attention by a researcher. As 
described above, for instance, fraud system 50 sends autos- 
tunned cases to the call back queue for manual analysis by 
a researcher. Additionally, a researcher may elect to send a 
case to the call back queue if, for instance, the researcher is 
unable to resolve the case. In any event, the researcher may 
retrieve a case that was set for call back by selecting 
associated case-selection indicia displayed on monitor 74. 
Workstation 66 in turn retrieves a next case (or the selected 
case) from the call back queue. 

In a related feature, as discussed above, fraud system 50 
preferably includes a no-autostun file, which includes a 
compilation of bill numbers designated to not be automati- 
cally blocked even if the fraud condition of an associated 
case is higher than a predetermined level. Workstation 66 
conveniently enables an authorized fraud researcher to view 
and/or modify the contents of this no-autostun file. For this 
purpose, workstation 66 may include no-autostun modifica- 
tion indicia displayed on monitor 74. When the researcher 
selects such indicia, workstation 66 displays on monitor 74 
information associated with the no-autostun file and prompts 
the researcher to add, delete or query the file. The researcher 
may then, for instance, add a bill number to the no-autostun 
file and/or may modify expiration dates associated with 
entries in the no-autostun file. 

Still further, workstation 66 advantageously enables an 
authorized fraud researcher to deactivate part or all of a 
customer account associated with a specified bill number. In 
this regard, certain bill numbers or customer accounts may 
be slated for deactivation based on specified fraud scenarios. 
Workstation 66 may therefore display deactivation indicia 
on monitor 74. By selecting such indicia, a researcher may 
deactivate the specified account temporarily or permanently 
in order to avoid further fraudulent activity or use of the 
account. 

Through the use of tools including those described above, 
a fraud researcher studies the case presented at fraud work- 
station 66. Based on the researcher's analysis, the researcher 
may elect to either block the underlying bill number, pause 
the analysis, refer the case to another researcher or close the 
case, as indicated generally at step 126 in FIG. 3. If the 
researcher chooses to block the bill number, fraud system 50 



11/16/2002. EAST version: 1.03.0007 



5,970,129 



17 



18 



responds in substantially the same way as if case manager 56 
had auto-stunned the bill number. Namely, the system noti- 
fies the network SCPMS 52 that the number is blocked and 
updates the status in CIS 68 accordingly. If the researcher 
chooses to pause the analysis, the case remains in the 5 
researcher's queue or passes to the call back queue and 
awaits further action. If the researcher chooses to refer the 
case to another researcher, the system places the case in an 
appropriate condition queue to await analysis by another 
researcher. Alternatively, if the researcher chooses to close 10 
the case, the researcher preferably places a note in CIS 68 
indicating that an active fraud analysis has been closed in 
relation to the bill number. 

Finally, in the preferred embodiment, each of the pro- 
cesses running in fraud system 50 is continuously monitored ^5 
by administrative monitor 76, in order to detect and respond 
to problems, or abnormalities, in the fraud system. As 
illustrated by FIG. 5, administrative monitor 76 includes a 
status monitor 78 (such as a Sun Spark 20 server) operating 
a status monitor process, and administrator workstations 80. 20 
Status monitor 78 is interconnected to communicate with 
each of the components of fraud system 50 to be monitored. 
In FIG. 5, these components are generally referred to as 
clients 82 of the status monitor server 78 but also include 
fraud workstations 66. 25 

In practice, the components of fraud system 50 run 
background programs that compile status information par- 
ticular to the functions performed by the components. In 
turn, status monitor 78 polls these components periodically 
and centrally compiles their information for administrative 
analysis. This status information may include, for example, 
the number of VLMs received by fraud system 50, the 
number and size of cases and subcases established by case 
manager 56, and the state of condition queues. In the 
preferred embodiment, this information is displayed on 
administrator workstations 80 and may be regularly saved 
and printed. 

Status monitor 78 applies a set of thresholds or parameters 
to the status information received from fraud system com- 
ponents. These parameters generally define acceptable lev- 
els of performance for the various components or the fraud 
system generally. Like the indicia discussed above, these 
parameters are preferably stored in memory as one or more 
tables or files and may thus be adjusted as necessary without 
the need to rewrite computer code. By application of these 
parameters to the status information compiled by status 
monitor 78, administrative monitor 76 determines whether 
problems exist in fraud system 50. 

In the event administrative monitor 76 detects problems in 50 
the operation of the fraud system, the administrative monitor 
generates a system-wide notice referred to as a "health 
warning." Health warnings are displayed in real-time by the 
status watcher program running on administrator worksta- 
tions 80. In addition, health warnings may be displayed in a 55 
status section on the monitors of fraud workstations 66, in 
order to notify the fraud researchers that a problem exists in 
fraud system 50. Further, in order to focus the researchers* 
attention on serious health warnings rather than all health 
warnings generally, workstations 66 may be customized to 
receive or display only specified health warnings. 

The health warnings that may be generated by adminis- 
trative monitor 76 include network health warnings and 
case-based health warnings. Network health warnings reflect 
problems related to carrying out fraud determinations in the 65 
communications network. For instance, if fraud system 50 
resolves to block a calling card number and notifies the 
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network SCPMS 52 accordingly, the IXC*s network should 
not permit calls to be made using that card number. 
Therefore, if VLMs then arrive at fraud system for calls 
successfully made with the blocked bill number, adminis- 
trative monitor 76 will issue a network health warning 
indicating that the network is not properly blocking the bill 
number. In turn, administrators, researchers or other desig- 
nated personnel may respond accordingly. 

A case -based health warning, in contrast, reflects a sig- 
nificant problem arising in relation to a case. For example, 
if the number of alerts generated in relation to a case rises 
above a specified threshold level, administrative monitor 76 
will issue a large-case health warning indicating that the case 
is serious and should be promptly reviewed by researchers. 
This situation may arise, for example, where a group of 
criminals has conspired to make mtUtipIe simultaneous calls 
with the same stolen card number, particularly where a 
no-autostun option has been set for the card number as 
described above. As VLMs for these fraudulent calls are 
received by fraud system 50, multiple red or double -red 
alerts will be generated in a short time frame and appended 
to a subcase. In response, administrative monitor 76 will 
issue a large-case health warning, which will enable 
researchers to expediently pull and analyze the case and 
block further use of the bill number. 

Preferred embodiments of the present invention have been 
illustrated and described. It will be understood, however, 
that changes and modifications may be made to the inven- 
tion without deviating from the spirit and scope of the 
invention, as defined by the following claims. 

We claim: 

1. A method for monitoring a fraud prevention system in 
a telecommunications network, 

said fraud prevention system comprising a plurality of 
components arranged to operate a set of fraud system 
processes, 

said telecommunications network comprising a switch for 
receiving and forwarding a call placed using a bill 
number, 

said fraud system processes including (i) receiving a 
record of said call into a computer system, (ii) estab- 
lishing a likelihood that said call involves fraudulent 
use of said bill number, and (iii) determining whether 
to block use of said bill number and, if so, blocking use 
of said bill number, 
said method comprising, in combination: 

compiling status information regarding operation of said 
fraud system processes; 

determining whether said status information satisfies one 
or more predefined administrative thresholds; and 

in response to a determination that said status information 
satisfies one or more predefined administrative thresh- 
olds with respect to a case in said fraud prevention 
system, generating a case -based health warning defin- 
ing an abnormality with respect to said case. 

2. A method as claimed in claim 1, wherein said case- 
based health warning comprises a large-case health warning. 

3. A method as claimed in claim 1, wherein compiling 
status information comprises periodically polling said com- 
ponents to obtain status information from said components. 

4. A method for monitoring a fraud prevention system in 
a telecommunications network, 

said fraud prevention system comprising a plurality of 
components arranged to operate a set of fraud system 
processes, 

said telecommunications network comprising a switch for 
receiving and forwarding a call placed using a bill 
number. 
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said fraud system processes including (i) receiving a 
record of said call into a computer system, (ii) estab- 
lishing a likelihood that said call involves fraudulent 
use of said bill number, and (iii) determining whether 
to block use of said bill number and, if so, blocking use 
of said bill number, 
said method comprising, in combination: 

compiling status information regarding operation of said 
fraud system processes; 

determining whether said status information satisfies one 
or more predefined administrative thresholds; 

in response to a determination that said status information 
satisfies one or more of said predefined administrative 
thresholds, generating a hedth warning defining an 
abnormality in said fraud prevention system; and 

displaying a pre-designated category of health warnings 
on a workstation monitor to provide notice of said 
health warnings. 

5. A method as claimed in claim 4, wherein said heahh 
warning comprises a network health warning. 

6. A method as claimed in claim 4, wherein said health 
warning comprises a case -based health warning. 

7. A method as claimed in claim 6, wherein said case- 
based health warning comprises a large case health warning. 

8. A method as claimed in claim 4, wherein compiling 
status information comprises periodically polling said com- 
ponents to obtain status information from said components. 

9. An administrative system for monitoring a fraud pre- 
vention process in a telecommunications network, said 
telecommunications network comprising a switch for 
receiving and forwarding calls placed using bill numbers, 
said fraud prevention process being operated by a plurality 
of components and including (i) receiving records of calls 
into a computer system, (ii) establishing a level likelihood 
that use of a bill number is fraudulent, and (iii) if said level 
of likelihood is higher than a predetermined level, blocking 
subsequent use of said bill number, said administrative 
system comprising, in combination: 

a computer system interconnected to said components and 
receiving status information regarding operation of said 
fraud prevention process; and 

a set of administrative thresholds defining acceptable 
performance of said fraud prevention process, 

whereby said computer system applies said administrative 
thresholds to said status information to determine 
whether said status information reflects an abnormality 
in said fraud prevention system and, in response to a 
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determination that said status information reflects an 
abnormality with respect to a case in said fraud pre- 
vention process, said computer system generates a 
case-based health warning defining said abnormality. 
10. An administrative system for monitoring a fraud 
prevention process in a telecommunications network, said 
telecommunications network comprising a switch for 
receiving and forwarding calls placed using bill numbers, 
said fraud prevention process being operated by a plurality 
^ of components and including (i) receiving records of calls 
into a computer system, (ii) establishing a level Iflcelihood 
that use of a bill number is fraudulent, and (iii) if said level 
of likelihood is higher than a predetermined level, blocking 
. subsequent use of said bill number, said administrative 
system comprising, in combination: 

a computer system interconnected to said components and 
receiving status information regarding operation of said 
fraud prevention process, said computer system being 
) further interconnected to a fraud workstation including 
a monitor; 

a set of administrative thresholds defining acceptable 

performance of said fraud prevention process, 
whereby said computer system applies said administrative 
5 thresholds to said status information to determine 
whether said status information reflects an abnormality 
in said fraud prevention process and, in response to a 
determination that said status information reflects an 
abnormality in said fraud prevention process, said 
^ computer system generates a health warning defining 
said abnormality, 
whereby said monitor displays a pre-designated category 
of health warnings, to provide notice of said health 
warnings. 

^ 11. An administrative system as claimed in claim 10, 
wherein a human views information displayed on said 
monitor. 

12. An administrative system as claimed in claim 10, 
wherein said health warning comprises a network health 

^ warning. 

13. An administrative system as claimed in claim 10, 
wherein said health warning comprises a case-based health 
warning. 

14. An administrative system as claimed in claim 13, 
^ wherein said case-based health warning comprises a large- 
case health warning. 

* * * * * 
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26. The apparatus of claim 23, wherein each said 
subscriber number in said group is affiliated with either 
a corporation^ cooperative apartment, condominium 
complex, business organization, or social organization. 

27. The apparatus of claim 23, wherein said central ^ 
storage means comprises a first non-volatile data stor- 
age device operably associated with said register means, 
and wherein said register means comprises a second 
non-volatile data storage device. 

28. Apparatus for repayment of telecommunication 
connections between first and second telecommunica- 
tion devices, each being operably assodatable with 
teieconmiunication lines of a telecommunication 
switching networi^ said apparatus comprising: 

storage means for storing telecommunication-time 
data representative of a prepurchased amount of 
telecommunication-time available for prepayment 
of telecommunication connections in said telecom- 
munication switching network; 20 

measuring means for measuring the time duration of a 
telecommunication connection established be- 
tween said first and second telecommunication 
devices so that at telecommimication process can 
be conducted therebetween, said teleconununica- 25 
tion connection being initiated by said first tele- 
communication device; and 

processing means for processing said stored telecom- 
munication-time data so as to reflect a decrement in 
said available telecommunication-time, which is 30 
essentially equal to said measured time duration of 
said telecommunication connection; and 

a register means for registering a group of telecom- 
munication lines within said telecommunication 
switching network, wherein each said telecom- 
munication-line in said group has access to a bulk 
amount of prepurchased telecommunication-time 
represented by tdeconmiunication-time data stored 
in said storage means. ^ 

29. The apparatus of claim 23, which further com- 
prises telecommunication-time status advisement means 
for generating and trananitting status information to 
said first telecommunication device so as to advise said 
first telecommunication device that said prepurchased 
amount of teleconununication-time has been decre- 
mented to a predetermined threshold amount. 

30. The apparatus of claim 29, wherein said telecom- 
munication-time status advisement means automatically 
geuE^tes and transmits said status information to said 50 
first telecommunication device in re^xmse to said pre- 
purchased amount of telecommunication-time being 
decremei:^ to said predetermined threshold amount 

31. The apparati»« of claim 30, wherein said status 
information is a message selected firom the group con- 55 
sisting of ^speech messages and facsimile messages. 
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32. The apparatus of claim 23, wherein said telecom- 
munication-time data is representative of a prepur- 
chased amount of telecommunication-time available to 
said second telecommunication device and for use by 
said first telecommunication device to initiate a tele- 
communication connection between said first and sec- 
ond telecommunication devices. 

33. System for prepayment of telecommunication 
connections between first and second telecommimica- 
tion devices, each bemg operably associable with tele- 
communication lines of a telecommunication switching 
network, said system comprising: 

a central storage device for storing telecommunica- 
tion-time data representative of a prepurchased 
amount of telecommunication-time available for 
prepayment of teleconununication coimections in 
said telecommunication switching network; 

measuring means for measuring the time duration of a 
telecommunication connection established be- 
tween said first and second teieconmiunication 
devices so that a telecommunication process can be 
conducted therebetween, said telecommunication 
connection being initiated by said first telecommu- 
nication device; 

processing means for processing said stored telecom- 
munication-time data so as to reflect a decrement in 
said available telecommunication-time, which is 
essentially equal to said measured time duration of 
said telecommimication cormection; and 

a register means for registering a group of subscriber 
numbers within said telecommunication switching 
network, wherein each said subscriber number in 
said regbtered group has access to a bulk amount 
of prepurchased telecommunication-time repre- 
sented by telecommunication-time data stored in 
said central data storage device. 

34. The system of claim 33, wherein each said sub- 
scriber number in said registered group is afiiliated with 
either a corporation, cooperative ^>artment, condomin- 
ium complex, bu^ess organization, or social organiza- 
tion. 

35. The system of claim 34, which further comprises 
telecommunication-time status advisement means for 
generating and transmitting status information to said 
first telecommunication device so as to advise said first 
telecommunication device that said prepurchased 
amount of telecommunication-time has be^ decre- 
mented to a predetermined threshold amount. 

36. The system of claim 33, wherein said telecom- 
munication-time data is representative of a prepur- 
chased amount of telecommunication-time available to 
said second telecommunication device and for use by 
said first telecommunication device to initiate a tele- 
communication connection between said first and sec- 
ond telecommunication devices. 

***** 
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